Suspicious
Suspect

f54c99037385d1c3c2809ccbd540d486

PE Executable
MD5: f54c99037385d1c3c2809ccbd540d486
Size: 3.27 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 f54c99037385d1c3c2809ccbd540d486
Sha1 26cd747d0bb7c0bbc3f5e2023049acd66bbd498f
Sha256 82c614f3781d0706d862e0f9f0a51db025fecbcaeb74107d060f6c4a0f6ad24c
Sha384 9d0e84cabcddde06a69cddfee0099bd8acd9a4f37b8ecb65153735e98411b28543a688b005e8da6d7e8d91d037890ea4
Sha512 0308136a801fcdbbf90a01d5314096ad7cc0d58b2b73c085a5c7c42530ce35090a76fb7221574530d5bca017feb844b7081bdb9f650921f29eb91d50fa3aa535
SSDeep 49152:HvyI22SsaNYfdPBldt698dBcjHQqRJ6BbR3LoGdWHTHHB72eh2NT:Hvf22SsaNYfdPBldt6+dBcjHQqRJ6j
TLSH 1FE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f54c99037385d1c3c2809ccbd540d486
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::ㄱ㶔볃胕�ﳅᵡ䥚힐爌㞮꠻盷ꨃ奫愀縣틘(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::乀똍轎픋삃鉈䤽눟젪뭾淑䯶풊퓋(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Ἂ琑ཹ諽꘤촨᭥睗摞ﭬ㋰宀궅윟◁ꐝ츜෻埾팅::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
Client
Full Name
Client
EntryPoint
System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::ㄱ㶔볃胕�ﳅᵡ䥚힐爌㞮꠻盷ꨃ奫愀縣틘(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 塎㓤น捅齯୏㒷˭곻딟뱃닶�弞䛤꾺莁걂屗::乀똍轎픋삃鉈䤽눟젪뭾淑䯶풊퓋(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Ἂ琑ཹ諽꘤촨᭥睗摞ﭬ㋰宀궅윟◁ꐝ츜෻埾팅::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
f54c99037385d1c3c2809ccbd540d486
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙